GCVE-110-OSM-2026-4176

Drops a Rust-compiled Windows PE backdoor (rebon.exe, ~20MB, VT 0/0) to %LOCALAPPDATA%\rebon\bin\versions\0.0.93\rebon.exe via a postinstall hook, then spawns it at require time. The binary imports keystroke capture (ToUnicodeEx/GetKeyboardLayout), clipboard access (OpenClipboard/GetClipboardData), full environment variable harvest (GetEnvironmentStringsW), screenshot capability (image/png Rust crates), and TCP socket connectivity (ws2_32) with BCryptGenRandom-encrypted C2 communications. Three versions published in two days, unsigned binary with compile timestamp spoofed to 2040. **Trigger** (`postinstall`): executes `node scripts/postinstall.js` on Windows only (process.platform !== 'win32' guard). **Drop**: `installManagedPackage()` in `loaders/lib/windows-managed.js` copies `payload/rebon.exe` to `%LOCALAPPDATA%\rebon\bin\versions\0.0.93\rebon.exe` via atomic staging directory. **Manifest**: writes `%LOCALAPPDATA%\rebon\bin\current.json` tracking installed version path. **Spawn**: `loaders/bin/rebon.js:spawnResolvedExecutable()` reads current.json at require time and calls `child_process.spawn(resolvedExePath, process.argv.slice(2), { stdio: 'inherit' })`. **Collection (confirmed from import table)**: keystrokes via ToUnicodeEx/GetKeyboardLayout/GetForegroundWindow; clipboard via OpenClipboard/GetClipboardData; full environment block via GetEnvironmentStringsW/GetEnvironmentVariableW; screenshots via Rust image/png crates + screen buffer APIs. **Exfiltration**: TCP via ws2_32 with BCryptGenRandom-encrypted payload; C2 destination resolved at runtime. **Evasion**: unsigned PE, compile timestamp spoofed to 2040-04-15, VT 0/0 at time of analysis.